Optional Component Setup Log Diagnoser

07/02/2012

24 minutes to read

In this article

Applies To: Windows Vista

This topic is intended for IT administrators who are troubleshooting OCSetup Event 3, OCSetup Event 4, CBS Event 4375, and CBS Event 4385. Because these are complicated issues, you may need to call Microsoft® Customer Service and Support (CSS) to completely resolve the problem. However, this topic can help you diagnose the cause of your issue. It includes information about how to review the event syntax and how to analyze the Windows Update and Component-Based Servicing logs. If you find errors that you cannot resolve, gather the information in the Calling Microsoft Customer Service and Support section to expedite the time it will take CSS to resolve the problem.

Note

This topic applies only to Windows Vista®—OCSetup is not used to install optional components on Windows Server® 2008.

The target installation value of the update, which can be -17, -16, 0, 2, 4, 5, 6, or 7 (as listed in the Install states table).

<InstallState>

The target installation state of the update, which can be Superseded, Default, Absent, Resolved, Staged, Uninstall Requested, Install Requested, or Installed (as listed in the Install states table).

Diagnosing the error

To diagnose your error, use the information in the following sections:

Windows Update log

Component-Based Servicing log

If you find an error that you cannot resolve, gather the information discussed in the Calling Microsoft Customer Service and Support section to expedite the time it will take to resolve the problem, and then call CSS.

Important

Any of the logs discussed in this topic can contain system errors (with the format 0x8007####), which you can find more information about online. To locate online error information, convert the last four numbers of the error into a decimal format by using Calc.exe. To do this, ensure that the calculator is in Scientific view, click Hex, input the numbers in hexadecimal form, and click Dec to switch to decimal form. Then search the System Error Codes for the decimal code (http://go.microsoft.com/fwlink/?LinkId=83027). For example, for error 0X80070490, you would convert 0490 to a decimal (1168). Then you would search System Error Codes for 1168.

Windows Update log

The Windows Update log is located at %windir%\WindowsUpdate.log. It contains Windows Update errors and Component-Based Servicing (CBS) errors.

To determine if this log contains the error that caused your problem

In the Windows Update log, search for the word FATAL. If you do not find the word FATAL, then close the log and diagnose the Component-Based Servicing log.

If the fatal error contains the acronym CBS, then it is a CBS error and you should search the Component-Based Servicing log for the error number. For example, in the following example, the error number is 0x800f081e.

This error means that the package being applied was not applicable to the computer and was skipped (not installed).

If the error does not contains the acronym CBS, then it is a Windows Update error. In this case, scroll up in the log file to find the closest error that contains WARNING. In the following example, the warning error is directly above the fatal error.

If you do not know how to fix the problem, call CSS and give them the specific Windows Update error number that you received.

Component-Based Servicing log

The CBS log is located at %windir%\logs\cbs\cbs.log. It contains the following types of errors:

Component-Based Servicing errors

Component Servicing Infrastructure error

Advanced Installer error

Driver installation errors

This section contains information about diagnosing the CBS log to determine the cause of your issue.

Important

Before performing any servicing operation, make sure logging is enabled by setting the following registry key. If you already performed the operation and the registry key was not set, then set it and repeat your operation:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing] EnableLog=dword:00000001This ensures that the CBS log contains all possible information about what occurred.

Component-Based Servicing errors

To find CBS-related errors, search for the word Error. CBS-related errors can be either:

CBS errors with the format 0x800f####. (For information about CBS errors, see the Common Errors section).

System error codes with the format 0x8007#### (as discussed previously).

When you find a CBS error, use the following information about the syntax, versions, elevation levels, and common errors to diagnose the problem.

Syntax

The syntax for CBS logged entries is:

<TimeStamp> <Severity> <Component> <Type>: <Description>

Parameter

Explanation

<TimeStamp>

The date and time that the error occurred.

<Severity>

The severity of the event—can be Info, Error, or Warning.

<Component>

The component that logged the message (for example, CBS, or CSI).

<Type>

The type of operation that the error message is about. Examples include:

Startup. The logged item is specific to the component's startup operation.

Session. The logged item is specific to a particular session of the component.

Appl. The logged item is specific to a particular client application of the component.

Exec. The logged item is specific to the components general execution operation.

<Description>

Description of the log entry. This description may contain CBS or system error codes if an error occurred during an operation. For example: Doqe: Failed writing driver operations queue with hr: [HexErrorCode].

For example, the following error is 0x800f081f, and the explanation is "Missing manifest for Package":

Versions and elevation values

The version of a component is divided into four parts with the following syntax: Major.Minor.Build.Revision. Revision can be either a distribution or a revision (for more information, see the elevation values table that follows these code examples).

When you upgrade a component, the type of upgrade is indicated by an elevation value. The elevation value indicates which part of the version was upgraded. Errors in the CBS log can contain the version of a component and/or an elevation code:

Upgrading the major and/or minor parts of the version—for example, elevating a minor version would mean upgrading from version 1.1 to version 1.2.

ServiceLevel

16

Installing a service pack.

Build

8

Elevating the build number—for example, upgrading from 6.0.5000.0 to 6.0.5001.0.

Distribution

4

Elevating the distribution branch—for example, upgrading from the RTMGDR branch to the RTMQFE branch.

Revision

2

Upgrading the revision part of the version (which is typically a fix for the component)—for example, upgrading from 6.0.5000.0 to 6.0.5000.1.

Install

128

Installing a component for the first time onto a computer.

Installation states

CBS errors can also contain information about the state of the parent package. For example, parent state: 7 means that the parent package is installed on the computer. The following table outlines the parent state values:

Installation state

Value

Description

Superseded

-17

This update has been replaced by another update.

Absent

0

The manifest is not on the computer.

Resolved

2

All of the manifests are present on the computer, but the files have not been installed or staged.

Staged

4

All of the manifests and files are present on the computer, but the files have not been projected, and they are not being used by the computer.

UninstallRequested

5

The update will be uninstalled after the computer is restarted.

InstallRequested

6

The update will be installed after the computer is restarted.

Installed

7

Everything has been installed on the computer.

Common errors

The following table lists common CBS errors with additional troubleshooting information:

Error Code

Explanation

Resolution

0xf0801

The Trusted Installer service is busy and cannot be accessed at this time. Most likely, another operation that needs to complete is using Trusted Installer.

Retry your operation in a few minutes.

0xf0802

While adding a source to a package, CBS recognized that the source was already present. The package may be minimally malformed (for example, a .dll may have been copied twice to the computer), but the issue is not significant enough to effect the operation.

There is no further action needed from you.

0xf0803

Operation succeeded. The servicing stack was updated and the computer needs to shut down.

Restart the computer to complete the operation.

0x800f0801

The session must be initialized before other operations can be initiated.

Close the application you are using to install this component or update (for example, Windows Update, OCsetup, or Package Manager). Then start the application and retry your operation.

0x800f0804

The package could not be found or it could not be opened. There are many possible causes for this error—for example, there may have been a network failure or you may have insufficient rights to access the package.

Ensure that you can access the package and try again.

0x800f0805

The package is not valid. You can only install packages provided to you by Microsoft.

Obtain a valid package and try again.

0x800f0806

One or more resources that are required by this update are locked. In most cases, this is not a problem because the update is now in a queue, and it will be installed when your computer is restarted. However, some updates cannot be in a queue and need to be installed manually.

Restart the computer. To ensure that the update is installed, try to apply the update again (do not apply any other updates at the same time).

0x800f0808

The offline image that you are attempting to modify is not accessible.

Ensure that you have sufficient rights to the offline image.

0x800f080b

A package property that is not available has been requested. The package may be invalid or corrupted.

Search for a Microsoft Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f080c

An operation has been requested for an update that is not present in the package. One of the components that the package contains may be invalid.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f080e

More than one element with the same name has been detected in a manifest element. The package may be invalid or corrupted.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f080f

A duplicate element has been detected for an element type that must be unique. The package may be invalid or corrupted.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f0810

A required attribute was not defined in the manifest. The package may be invalid or corrupted.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f0811

A required element was not defined in the manifest. The package may be invalid or corrupted.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f0812

CBS attempted to validate a parent element in the manifest and failed because the parent was not present. The package may be invalid or corrupted.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f0813

CBS attempted to change the package to an invalid state. The package may be invalid or corrupted.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f0816

The express package has not been completely downloaded. The state of the operation has been saved while the package is downloaded. An express package is a package that you install using Windows Update. With these packages, only the files needed for that specific computer are downloaded and installed (in contrast to when the entire package is downloaded to a computer).

There is no further action needed from you. Wait until the express package is downloaded.

0x800f0817

Another package that this package requires has been uninstalled.

Look at the errors around this error in the log to find the package that you need to reinstall. There should be an error that indicates which package this package depends on. Reinstall that package and try the operation again.

0x800f0818

The manifest contained in this package does not have the expected identity. The package may be invalid or corrupted.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f0819

A duplicate update has been found. All update names in the manifest must be unique. The package may be invalid or corrupted.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f081a

The driver operations key is invalid or corrupt. The package may be invalid or corrupted.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f081b

The driver package that you have attempted to install was written for an unknown architecture type (for example, the architecture is not for x64-based, x86-based, or Itanium-based). The package may be invalid or corrupted.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f081e

The package was not applicable.

Ensure that this package applies to Windows PE and that the computer meets all of the requirements of the package.

Then search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f081f

A source file or manifest for the package could not be found while the package was being extracted or during the installation. For example, there was a missing manifest for the package in use.

Make sure that you have enough disk space, and download the package again. If you continue to receive this error, then you may have insufficient rights to the files on the computer or the package may be invalid or corrupted. To resolve this, search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f0820

A user has canceled this operation.

Requires no further action. This is an informative message and not an error.

0x800f0821

A client has aborted this operation.

Check the logs for the application that you were using to install (for example OCsetup, Windows Update, or Package Manager) to identify why the computer stopped the operation.

0x800f0822

The package contained a driver update that did not specify <updateDriver> in the package manifest. The package may be invalid or corrupted.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f0823

The package requires a version of the servicing stack that is not present on the computer.

Retry your operation. If you receive the same error, restart the computer and try again. If you continue to receive this error, then the package may be invalid or corrupted. In this case, search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

0x800f0901

In a given package, only one <updateComponent> is allowed for a component family.

Search for a Knowledge Base article about this package at http://go.microsoft.com/fwlink/?LinkID=46046. You can often find the Knowledge Base number in the .mum file of the package (search for KB) or in the error message. If a Knowledge Base article does not exist, then download the package from the Web again and retry the operation. If you continue to receive this error, call CSS.

Component Servicing Infrastructure error

Component Servicing Infrastructure and Advanced Installer errors are prefaced with (F) in the CBS log. To find these errors, search for (F) in this log. The following code sample is a CSI error because it contains CCSITransaction::ICSITransaction, the error code is 800736b3 and the explanation is "SXS assembly not found".

Advanced Installer error

Now you should look for an Advanced Installer error. To do this, start from the last failure that contains (F). If it is an Advanced Installer error, then it will be followed by an error code. In the following code sample, the error code is 8007313. In addition, Facility=FACILITY_WIN32 indicates that this is a system error code—in this case, 14099 (see the Important note in the Diagnosing the error section for information about system error codes).

Now, look at the previous failures in this log and locate the error that contains CMIADAPTER. The failure following CMIADAPTER indicates the advanced installer that failed (in this example the service installer failed, which is indicated by Installer: Service). After you have located the advanced installer that failed, then call CSS with this information.

Driver installation errors

To find driver installation related errors, search for errors that contain the word Error and begin with the word Doq. These errors can be system error codes (see the important note in the Diagnosing the error section for information about system error codes). The following code sample shows a driver install error that contains the system error code 0x80070490:

Driver logs

If you were using Package Manager to install or uninstall a package that either installs, updates, or uninstalls a driver, you can create the Drivers.log to help troubleshoot. (The Knowledge Base article that is associated with the package may indicate if the package updates a driver.) The Drivers.log contains only driver-specific errors. To create this log, set the following registry key, and then rerun your Package Manager operation. This will create the Drivers.log in the directory where the Package Manager operation is run.

If these logs do not exist or do not have information in them, then you can either contact CSS or turn on verbose setup logging. To enable verbose logging, follow the steps in "Setting the Event Level for a Text Log" (FWLINK) to set the value of the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\LogLevel

For more information about troubleshooting driver issues, see the following:

Calling Microsoft Customer Service and Support

In addition to the Windows update and CBS logs, you can review the following four logs for system error codes that can help you troubleshoot:

The Windows Side-by-Side Pending log. This log is located at %windir%\winsxs\pending.xml. It contains pending transactions that will be run when the computer is restarted and the associated errors for the transactions. This is especially helpful when diagnosing CBS and Component Servicing Infrastructure related issues.

The Windows Side-by-Side Pending Bad log. This log is located at %windir%\winsxs\pending.xml.bad. It contains errors for packages that failed from the Windows Side-by-Side pending transactions.

ThePending Operations Queue Exec log. This log is located at %windir%\winsxs\poqexec.log. It contains errors for the rest of the installation after a computer is restarted. Every failure in the pending operations queue generates one line in Poqexec.log.

If you still cannot resolve the issue, collect these logs (along with the Windows Update, Component-Based Servicing, and Driver logs) and then call CSS. For information about how to contact CSS, see the Microsoft Services Support Web site (http://go.microsoft.com/fwlink/?LinkId=89446).